Kent Barton & Alex Gluchowski ~ Scaling With Zero Knowledge

[Music] so thanks for joining us for a skilling discussion scaling is super top of mind right now in in blockchains in general and especially etherion the question really is how can you how can you scale this technology in a way that doesn't involve too much centralization it's easy to have maybe 21 nodes or something like that and have faster transaction throughput that's sort of the naive way to do it and maybe for some use cases it's effective of course in aetherium we want to be maximally decentralized the centralized is possible so how to go about that there's a few approaches and we're gonna get into one very promising approach which relies on zero knowledge proof s-- so one thing to keep in mind for anybody developing adapt is it's super crucial to get a sense of how you might scale your technology your your dab we made the mistake I hesitate to call it mistake it was a very cool application but we had a scale fail at shapeshift who heard of prism or played around with prison it was pretty much all on chained and waited to manage your assets in a decentralized fashion and it was cutting edge super cool people responded well to it what it lacked is the ability to scale effectively so when the the big bull market hit in 2017 and gas prices went through the roof we you know you always hear about crypto kitties shape-shift with prism we encountered a lot of the same challenges in terms of paying very high fees to maintain or Oracle it was expensive for users to rebalance their portfolios and it kind of was just a general so the idea now with you know I kind of across the ecosystem is if you have a great decentralized applique an idea cool but make sure or starts to factor in right now how it's going to scale effectively so the way this really is is gonna work potentially is through different layer two solutions until layer one hits with shardene and some of the other things you've probably heard about you've heard a lot about plasma that was a big thing at Def Con today's talk is going to be on zero knowledge proof switch is a different layer to solution and there's two flavors that we're going to talk about so Alex from the theorem foundation is gonna start off and talk about scaling using ZK snarks hi everyone yes I've been working on the roll up this is the project we call this this kind of iteration of plasma what we don't call it plasma because plus many people don't like it it's an idea of a sidechain which is driven by easier knowledge or specifically by snarks the other approaches Starks and ken is gonna talk more about it so how many of you are familiar with zero knowledge proves in general that's good and how many of you like really know what you can do with it what what can be built with your knowledge how exactly they work okay much less people so I'm gonna dive a little deeper in the technology and take you step-by-step through how you actually do use your knowledge and how we do it for for for for scaling so zero knowledge is in general cryptographic protocol which allows you to prove that some computational statement is true without revealing any information about the statement and in in the input parameters of the statement other that is that what the verifier already knows so it takes so more specifically we have one function which is publicly known everybody agrees everybody knows what the function it represents we call this function circuit because it's it's very similar to how high-rez circuits are built we have some public outputs and public parameters which everybody also knows which can be different from verification to verification then we have some hidden parameters some private input which we call witness which we're not going to disclose to anybody but we're going to prove that we have we know some witness such that if we evaluate this function on this witness we're going to get the public parameters and the great part about zero knowledge proof such as snarks and Starks specifically is the S parts the case not extend for zero knowledge sixteenth non-interactive arguments of knowledge zero knowledge means that we don't disclose information about the private input 6in means that the verification part is much much lower than the approver so the verifier must do much less work and this is what we use for scaling non-interactive means that they're in there is not supposed to be any interaction between the approver and the verifier in some protocols you need kind of some kind of interaction for example where the probe of the verifier will send some public randomness to the prover and then the probe will respond but we have a trick called Fiat Chenier eristic switch allow us to just the prover just post some data on chain and anybody can read this data and and be sure that they statement is correct an argument of knowledge is basically like the ability to convince you that I know the secret input such test this function the circuit evaluates together with the public parameters to truth so how so what's what's great about snarks specifically is that the verification cost is super super cheap like the prover cost is off end which which is like you cannot go below that you have to execute each transaction at least once to go through like each not transaction in our cases transactions but essentially like any part of this circuit of this big public function you cannot go below n like where n is the number of steps in the circuit however the very fire always does the same amount of work which is constant no matter how many steps are in the in circuit and the very physical communication complexity which is the amount of data which we put on chain is also constant and as its it's extremely low in in case of snarks we only need two hundred eighty eight bytes to be posted on chain to convince you about the statement think about it two hundred eighty eight bytes it's like not kilobyte it's not megabytes just I mean it's literally nothing so how it works exactly for scaling we have a main chain which is the sequence of blocks and these blocks have limited capacity we can only fit so much in each block in terms of data or computation in in either we measure it with gasps now we can introduce a side chain what we do for plasma and for for any other types of side chains and the idea is that the side chain is completely off chain so we can scale however the security of the side chain is guaranteed by the main chain so for each block on the side chain we make a cryptographic commitment and we send a short cryptographic thing on on a main chain normally it's Merkel root hash of the side chain and then once it's committed on the main chain and included in the block nobody can change it so any decision can only go further and we can have a smart contract on a main chain which governs the the commitments and then if something goes wrong in case of plasma if an operator of side chain tries to commit a new block which is invalid users have some period of time where they can object and the smart contract will we can provide proof of fraud and say hey this was the previous state this is the new state however the new state includes something maybe some transaction which I did not sign on my behalf from my account somebody's trying to steal my money please revert it which requires everybody to be online constantly and verify the chain which which is a severe limitation of scalability and also of security because it's not possible for everybody to be constantly online and you might have injections on the main chain so your your transaction of objection can be censored and so you can lose my so like security is not so cool in this side chain we can have some state right so let's assume we have an account based model I can aetherium so you have some accounts each account represents a user with a private private public key player in some balance and we aggregate it in a miracle tree represented by merkel root so we now have this miracle root and we commit a ton chain so what we can do with snarks is that we can prove that the new state in numerical route we should commit in the new block is a result of some function which takes the ol root the full state and the set of transactions as as parameters and the result is the new root so we can essentially prove with your knowledge that the new block is correct that all transactions included in the new block are valid that they have been signed correctly by by people who own their flee funds and that nobody spends more than they own and that nobody makes double spends and this proof with the snark proof is verified by the theorem smart contract so users don't have to do to be on line and to check and make any objections the operator cannot simply commit any incorrect block any name on the main chain so how it works exactly for each new block we create a snark circuit which is like a large function which we evaluate and in this function we just have like n transactions which is a fixed number and for each transaction we go and check that the signature is correct and belongs to to the person who owns the account that we have a merkel path from from this account to the root and this root belongs to the previous root which we had that we update the account correctly that the we only take the amount which was signed by the user and detracted from from the his balance and edit and to the balance of the recipient and then we check that the new state you correct like the the root hash has been updated correctly and the the verification is extremely cheap and fast and takes like literally just like half a million guests at the moment on on the theorem chain for like huge number for sixteen hundred of transactions for in the prototype which we currently have online on on the test net however the prover takes some time it takes it depends on the hardware which we use so if we have a huge machine with many dozens processors we can do it in maybe one minute only on my laptop until it takes 20 minutes for this large block which also can be done so but how do we achieve throughput like each block costs very little and includes many transactions but it has to be verified too in aetherium and if we have to wait 20 minutes for the next block we won't be able to have high throughput right because like this this 20 minute delay will create inefficiency so what we do in in the roll-up right now is that we run the transactions we run the commitments in parallel so we have two parallel pipelines we have commitments for each block where we just provide the data which is going to be included in the next block and then five ten twenty minutes later we follow with the verification and certification doesn't fall we can always revert so the finality has this delay but users can request from operators all the data I can verify the data in themselves and and be sure already from the moment of commitment that the data is safe so like I can go if it's not clear I can answer the questions about this so the the big challenge we have with roll-up is or with this approach in general is data availability if data availability was not a problem we would be able to scale it almost indefinitely however if somebody commits a block and this block is completely correct and then it's represented by new route hash but nobody knows the underlying data like I changed something in one of the accounts by a correct transaction but I don't tell anybody what exactly I changed then nobody can work with this sidechain anymore nobody can prove anything the new you like if we have multiple operators which work in sequence they cannot continue operation so we need everybody to know exactly what happened for each transaction and this is a hard problem to solve plasma has some ways to solve it like there are some edge cases it's it's non-trivial like this has been the biggest Peron in plasma research over the past year so we solve it by submitting transaction data for each transaction on chain in aetherium but we only use TX data so we don't use storage we don't do any computations we only use like 9 bytes of data which is 400 guests per transaction just to make sure that everybody gets this because we rely on etherium for like as a broadcast layer and this yeah this is the this is what we put in in this on chain data and this limits us because we have guest limit for each block so we can only put like the current version can only support like up to 500 transaction per second this is a hard limit because of this data availability part but efforts are in a way to solve data availability differently and if you have any ideas please come talk to me after the presentation happy to discuss it in more detail but now like we can do 500 transactions per second which is awesome because this is already much more than aetherium can handle and the logic of each transaction can be also more complex than just simple token transfer can be atomic swaps it can be some complex logic with like sharing like mail many mod multi-sig and so on and sounds like we can extend it significantly so the only really big challenge for snarks and the only big in my opinion but maybe kin will disagree will see disadvantage of snarks against arcs is the trusted set apart trust the set up is what we call a common reference string we need to create some public randomness and then people who create this randomness like person or multiple participants need to forget it and just provide the result of the computation in order for the scheme to be secure so normally it's used in like obviously you cannot trust one person because there is no way to prove that the this what we call toxic waste this initial entropy randomness is deleted so instead we rely on something like multi-party computation just like what Z cash did with sampling and with with sprout the previous version we have many participants such that if at least one of them is honest the entire scheme is solid and sound sorry it's only possible to mess up if every of every one of the participants agree to collude and all of them retain the data and then they can reconstruct and make fraud proofs and the problem was was up until now with snarks that the trust is set up had to be done for each individual circuit and this limited severely the application domain of snark so it you could use it for certain applications where you just have two parties or maybe multiple like a few parties where all of them can participate but not really for public applications because you don't know those people and it's difficult for you knowing to establish this trust and it's very difficult organization it just to get everybody together and participate on on every circuit on every update on every new application however luckily we have since two weeks a new construct proposed by Shan ball from Z cache which offers like Universal common reference string or just to set up as fast as that still has to be done but we just need to do it once with many trusted like many reputable participants and it's gonna work for all up late for all applications for all circuits you can do anytime and update you just rely on this imagine like if you have high profile people hundreds of them participating the probability that all of them could lose it together like is close to zero so I would totally trust all my fortune on such a side chain and yeah we're in mattering already working on implementation just check it out stay tuned you can follow us on Twitter so now it's interesting to compare it to Starks can cool thank you Alex it just occurs to me that Sonic would be a better fit perhaps for ringing signatures sorry awful joke okay so just to preface all this with a few general comments one of the things that makes the the zero knowledge proof family of scaling really interesting I think is the fact that it relies on cryptography and mathematics rather than game theory this presents some interesting sort of different trade-offs but I think advantages when it comes to scaling scenarios namely and some of the stuff that Alex alluded to in terms of what makes plasma difficult you know the idea of having to have exit games I need to be able to challenge and exit so what that means for the user is potentially you might have to wait like five or seven days to withdraw your funds those workarounds on this and people are jamming on plasma there's a lot of different flavors of it and it's pretty cool and it's promising but this is a way to sort of circumvent some of those issues because if you can believe if you believe the math and this stuff is very cryptographically sound it appears then you're in much better position to have scalable technology so a lot of what alex already said applies to two Starks as well Starks and Starks are very similar the the fundamental idea of scaling transactions using you know rolling up transactions and batching them it still applies but you're going about it differently so as they would say in Thailand same same but different so let's look at some of the the notable differences Alex mentioned the most important difference I think which is there's no trust at setup and in this world where maximal trust lessness is super important I don't think this could be understated you know people even though the paranoid conspiracy dudes out there on Twitter you know sometimes say well Z cash you know you never know it maybe the NSA has you know the key or somebody's going to bring it all down on a more pragmatic level I think what this means is various projects can spin up a Zeke a stark instance without requiring a big set up sort of ceremony and that this makes it a lot more potentially adaptable to different different gaps you don't really need a critical mass of people to do a trusted setup ceremony it's more frictionless to implement another key point and Alex might have some differences on this as well proving time generally seems to be faster with Starks this has advantages in terms of throughput one important disadvantage relative to snarks is the proof size is like to two orders of magnitude bigger so this means when you're posting stuff to chain it's really not it's going to take up more space and it creates some some friction there so is it a blocker I wouldn't say that but it's definitely a trade-off to keep in mind on the plus side Starks are a quantum resistant so that's good to keep in mind although as alex pointed out the other day if quantum computers come out then we know we have bigger problems than just layer two solutions we're gonna have to port all blockchains over to quantum resistant chains one interesting thing to keep in mind is most of the development in terms of Starks right now is being done by one organization they're based in Israel and they're called Starck where one of the founders of Starck where is le Ben Sasson who is also a founder of Zee cash so he's very well steeped in the zero knowledge space Starks are a relatively new type of scaling solution but they're built on older cryptography it's it's it's pretty well proven out mathematically and one of the things that'll be interesting to see in the near future is we'll other groups sort of start jamming on and innovating on Starks or will it just be under that sort of the purview of one group right right now it's just pretty much stark we're just a few slides here and these did come from Starke where so perhaps they're a little bit biased but these guys seem very they have a lot of good data behind their their charts anyway this kind of shows some of the comparisons with proving time an interesting question that I think is sort of on you know not quite defined yet is to what extent does small differences in proven time matter for the for the end-user and for the adapt this remains to be seen will have to actually build functional technology before we can really get a better understanding of these of these trade-offs verifying time is very fast with Starks so the verification happens in a and we'll get into this shortly but it happens in a smart contract so the verification happens on chain it's a way of just saying that yes in fact this proof is valid and there's different ways to go about it but this is sort of one one advantage as well of the the stark approach okay so so in a nutshell here's how it works you you use what's called stark prover nodes and these are actually off train hardware like a you know maybe even a single core computer or a multi-core computer right now it looks like you know Starks in their early days might be running these themselves so that begs the question if if stark where or some private company is running these nodes is it still trustless and in fact the answer is yes because if they try if anybody any of these prove your nodes running stark hardware tried to mess with the data this would be this would be detectable so the nature of this technology is such that even you know a small change to the data would would make it obvious that it's been changed it would render the proof moot so you can still be trustless even when you have this off chain node or proving Hardware run by somebody else so this this is doing the proof an on chain smart contract verifies the proof and what this really means in sort of simpler terms is we don't need to have a non change signature for confirmation and storage this is to offloading a lot of computation a lot of gas spending that would otherwise be occurring on chain and taking that off chain and that is where the scaling comes from sort of what Alex was discussing earlier so tentatively it sort of looks like this could lead to a 10 to 20 X scaling improvement if you take this take these things off chain and the again that the approach is is pretty similar to what roll ups and snarks would entail is imagine you're add X and you have a lot of transactions happening off chain you could post all these to chain and have been verified everybody is happy and it's trustless but of course that doesn't scale at all because when gas prices go up you're spending a lot you have to pass that on to your users or eat that cost yourself it's not very elegant and scalable in this way you could have 500 transactions and these all are batched in one one nice little proof and then the proof is posted to chain in such a way that everybody can verify that the transactions happened everything is cool aboveboard but your your a lot of the data and a lot of the gas computational spending is is never hitting chain data sizing gasps coughs scale in a sub linear fashion so kind of a way to visualize that is let's say take one transaction and post that set the chain cost X gasps using using Starks you could take 500 transactions and and batch those up and it would only take 3 X the gas so there you can kind of see the the scaling potential of batching these and and it's a potentially a dramatic improvement so as with any scaling solution you know there's no magical fairy dust we can sprinkle on things there's always trade-offs so it is a relatively larger proof size again a few orders of magnitude larger than snarks this could present some challenges I think it's a little too early to say exactly you know what that might look like but it could limit the scaling potential again this is this is bleeding edge stuff it's untested in real life applications we're very early on in the game it looks promising but things need to really be proven out in in real life for optimal results we need stark friendly hash functions and pre compiles so one of the interesting things about both of these technologies is the EVM is not ready for it could implement these yet but it is not optimized for for snarks and Starks in the case of Starks ideally we would have stark friendly hash functions and pre compiles so we'd have to modify the EVM with the EIP and one of the one of the forks coming up it's still possible even without these but it won't be optimized unless and until that happens finally you know one of the ideas is like or one of the challenges is ultimately you have to you have to post these batched transaction proofs to the chain and if things get really maxed out again and blocks are always full well how can you how can you post a proof to the chain when things are full so then you introduce a situation where maybe you're just paying a lot to get that proof onto the chain which is maybe okay trade off but it sort of eats away at the savings a little bit so again it's not like this is a magical it's not like this obviates the need for layer 1 solutions like you know proof is there shardene and and sort of creating the etherium 2.0 thing it's it's complimentary to that and perhaps maybe building a bridge to win when that's available in a few years so kind of you know a few questions from what this might what might this look like from the end users perspective and the DAP developers perspective how long does it take transactions to effectively settle it's likely that five to seven days is way too much that's the plasma paradigm they're probably bringing that down but you know we want instant gratification in this in this world ideally maybe we get down to twenty minutes is that is that okay for a lot of these cases it probably is for some maybe it's not the marketing of Starks this is very novel technology how can we how can we convince users of it that it is truly trustless and it's safe and secure you know this is this is new stuff we're all collectively just getting our heads heads around it you know for the end-user how do you convey that these crazy zero knowledge proof swith this Hardware over here and making makes it safe that's maybe a challenging for the marketing people out there also how much will transaction fees actually decrease if it's a substantial decline maybe the apps will choose to pay their fees themselves in order to encourage adoption so in other words this could be a really cool onboarding scenario maybe leveraging meta transactions where you know it right now there's a lot of friction that comes with using adapt for the first time maybe may like add X or whatever given DAP might actually just decide to subsidize these costs because they're paying a lot less for taking transactions on on chain so there's some potential UX and onboarding improvements there as well this also applies to I would say roll-up since and snarks as well so how do you keep tabs on this again this is this is a pretty novel type of scaling technology built on some well-known cryptic crypt cryptographic fundamentals and primitives but things to watch or I would just keep an eye on what stark wear is doing again they're kind of pushing things forward see the updates see how they're what have they been doing lately how are they bringing improving times down and improve sizes especially they seem to be making steady progress they're actually they've announced a test net with 0x which is very cool 0x seems to be a very good fit for what they're doing so see how that looks like once the test net is out if it's available maybe try using it see what it looks like from a user's perspective also snarks and roll-ups look like they'll probably be available sooner what lessons might be learned from from that it's again that's very promising and I think a lot of the technology there and potential pitfalls and advantages may be Starks could learn from as well one thing one really cool thing is like be more optimistic you know we kind of feel constrained by scaling challenges but kind of imagine a situation where scaling is addressed I don't want to say solved but you know what if you can do to 500 transactions per second what would your DAP look like what could you do don't be afraid to dream big when it comes to you know the throughput of your DAP Stark said also look this is looking down the road a little bit they could potentially help with some of the charting challenges namely the the the need to have provable computation and cross change charting it gets pretty technical but Starks potentially couldn't could be useful there that's it if you guys have any questions let's see do we have another mic for her okay the question is why not use a different cryptographic protocol like elliptic curve signatures to or something similar why zero knowledge proof well because it wants scales so this is what we do with the theorem you use elliptic curve signatures to sign every transaction and this transaction goes broadcast to all participants of the chain and every one of them verifies every single transaction oh I see so you're saying like what if we just sign the the root hash off of the side chain and just have like a bunch of signatures may be like threshold signature with validators well in this case you will have to trust those people who sign the they update like somebody signs they update the the if theorem contract will check the AHA yeah III see like the majority of the validator signed it but you still as if as a as a user what guarantee it gives to you is that the validators agree on consensus kind of what we have in Peoria Network well and I'm not sure I'm getting the question exactly so like I was just saying right at the base have the same function of verifying right anything right so I was giving an example that if I write an elliptic curve signature in a smart contract right it's the same as me writing zero proof protocol as a smart contract right and the smart contracts job is to verify that the side chain is you know I don't know the side rate right you good so so what I'm trying to ask you guys is why why can't I use any other protocol it's the same thing sure I can answer that easily you can use other protocols there are also other zero knowledge proof protocols like bulletproof and Leggero and higher acts and others or you can just rely on the elliptic curve cryptography in general or you can even rely on like Lampert signatures without elliptic curves which are quantum resistant the only advantage of snarks and Stark specifically is this Exynos so that you by verifying the proof you verify much less like you do much less work then the prover did like the prover can can provide a proof for like thousand transactions but for you to verify it costs the same is just very fine one transaction where as with all other protocols your verification cost is on there with the prover cost in this is why you don't get scaling then you have to rely on different scaling techniques such as charting or different consensus mechanisms and so on mr. Sasha I have a question around the validators you said they require a lot of compute what incentive do they have to do that compute power because you need multiple validators for every transaction interphase right well we not we don't necessarily this can set we can have just one validator just one Operator who is still gonna remain trust less because they cannot cheat but if but what's the incentive for them because it still costs something right and if we have multiple operators what's the incentive for them and the answer is very simple we can introduce something like fees so we can introduce a new side chain and then all transactions on this side Shion still cost something like there is no free cheese right so but this week the cost is gonna be much less than current gas cost because it doesn't go to the miners with limited resource on unguessed which they can sell you it goes to validator since then they're gonna be either validator pools or just a like set of validators who produce block in blocks in turn who get paid by not necessarily by gas they get paid by some fees like these fees can be denominated in in the tokens being transferred for example in stable coins in whatever we're need it's it's not limited but essentially yes the users who use the sidechain who will transact there they have to pay for it because it still costs um it's gonna be much less than the current transactions but it's still going to be some like mmm don't like fraction of a cent or something you want that add to that like one fascinating possibility here is you know there's gonna be a lot of unused hardware like namely GPU miners once we switch over to proof of stake whenever that happens the the idea of having incentivize proving proof or nodes is a way to use that that hardware and in a way that helps maintain the security of of DAPs but also you know it's sort of really this excess capacity that will be left over after the transition and and in this fashion you could actually devote these resources to to have improver nodes in in Stark where or the Stark land can currently it's really this one organization will what run these prove her nodes and you know imagine don't they'll take a cut but hypothetically anybody could run these so in the spirit of making everything as decentralized as possible you know there is clearly an incentive to prove these things out and there will be a lot of hardware to so I feel like that's an underappreciated aspect of this technology is is kind of finding new ways to to use miners mining Hardware for for zero knowledge yes so how I guess would this be easily integrated into other blockchain technologies maybe like that are more consortium based or private blockchains as well that are not aetherium based yeah that's a great question hypothetically I'm not aware of any reason that couldn't happen my first thought would be for a private chain they sort of solved scaling by but just being more more centralized and permissioned so by the nature of those block chains there they already have pretty high throughput but maybe there'd be situations where you would want want to sort of have yeah absolutely yeah so maybe you could find the right sort of balance there so I like to add that this is a very good question and indeed the the great unique opportunity we have with zero knowledge base scaling is that we can add privacy so we can add probable privacy which is accountable but we can add confidential transactions we can add completely private transactions where and the participants are not seen and we can also add private computations which are scalable so we will have eventually user-defined smart contracts in during like based on zero knowledge techniques which are verified by others your knowledge cause which then are aggregated into one block and I see no reason why it cannot be integrated another block chains it just will take some time it's it's not as flexible as arbitrary smart contracts on egoism or with a theory on virtual machine initially these contracts will have to be written by hand and will have to be very specific but eventually we will progress towards they are arbitrary mutations so just like more practical sense is there anything nowadays on test net that has like a or an SDK that allows us to use this nowadays especially in regards to private transactions so there is a plasma Ignace implementation by me and Alex Plaza frontmatter Inc it's on test net you can you can try you can play around with it it's currently a centralized operator proving a transactions but we're working on a new lease which is gonna be coming soon where you can actually play around we're gonna provide SDK API and it's gonna be very compatible with existing tool kits you will be able to do this if you proud transactions are the next step after that because we focus on scaling first it doesn't private transactions without scaling do not make sense like in in Z cache we have shielded transactions and transparent transactions and so few people take use of shielded transactions that they are themselves just by the fact that they use it if you have like this big black pool nobody knows what's inside but you put four bucks in and then next day four bucks is coming out of that it's kind of obvious who did this right so you need a lot of you know a lot of throughput to be able to hide something in confidentiality that's why scalability must come first but if you have any interesting idea on scalability how you want to use it please come to me after the talk and let's talk about this you want to add something in terms of Starks it's it's currently imagine they have a lot of action on github but in terms of the kind of Nexus of what's happening it's really all about these test nets that they're they're aiming to build out so 0x is the first one of these I suspect over the next few months we'll see a lot more different types of test nuts if you happen to be a developer on adapt that is kind of looking to solve some of these challenges it's worth approaching them from their perspective they're very eager to prove this technology out but I also think over the next few months we'll see maybe other other projects kind of embracing what they're doing and kind of their own putting their own spin on it and that excites me too it's just all the spirit of you know very open source I think we had a question back there ok oh cool yes so the question is about signature aggregation whether we can prove BLS signatures in the snark and the answer is yes we can prove anything we just cannot make like arbitrary like we do not support Turing complete language is yet for zero knowledge for snarks and Starks they are going to be possible in the future but for now if you define a function which is going to be like let's prove or let's verify this array of BLS signatures we can totally do this and it's gonna be cheaper if combined with other tools because currently on the theorem the verification of BLS aggregation will cost you around 200k gasp verification of a growth 1600 a snark scheme is 600 K gasp so it doesn't really make sense for now unless you just combine it with other with other things but if you combine is it totally makes sense yes and then verification does not cost more verification is always constant it's always like this exam ok ok we're running out of time thank you everybody [Applause]